My working theory is that the attackers hacked polo, got a list of non 2fa, then went manually through them alphabetical.

The hacker has been able to do this for atleast a month and a half.

The hacker drained my account nearly exactly like yours by setting counter trades.

Yes polo should be able to track this, have they made any effort to call in authorities? I doubt it.

Hence, I believe they should be opened to a lawsuit.